CVE-2023-39362

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution on the underlying server. The `lib/snmp.php` file has a set of functions, with similar behavior, that accept in input some variables and place them into an `exec` call without a proper escape or validation. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78CWE-77

Affected software

VendorProductVersions
Cacticacti< 1.2.25

References

Timeline

Published
Sep 5, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-393635.9Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy CVE-2023-393645.4Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, users with console access can be redirected CVE-2023-393656.3Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined withCVE-2023-393664.8Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-ScriptinCVE-2023-393677.2An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specialCVE-2023-393686.5Protection mechanism failure of bus lock regulator for some Intel(R) Processors may allow an unauthenticated user to potentially enable deniCVE-2023-393696.1StarTrinity Softswitch version 2023-02-16 - Multiple Reflected XSS (CWE-79)CVE-2023-39374.8Cross site scripting vulnerability in web portal in Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows aCVE-2023-393705.4StarTrinity Softswitch version 2023-02-16 - Persistent XSS (CWE-79)CVE-2023-393716.1StarTrinity Softswitch version 2023-02-16 - Open Redirect (CWE-601)CVE-2023-393728.8StarTrinity Softswitch version 2023-02-16 - Multiple CSRF (CWE-352)CVE-2023-393736.5A Hyundai model (2017) - CWE-294: Authentication Bypass by Capture-replay.
CVE-2023-39362: High severity, CVSS 7.2 | Vulnix